fix(fuzzer): make the widened AST generation actually fire

[AztecBot]

Stacked on #13476. Measured over freshly generated programs, three of that PR's four new generation features almost never fire, and one of them cannot fire at all. This makes them reachable and fixes the generator bugs that stand in the way.

Counts are AST-node tallies over N programs generated with Config::default().

as_vector and str_as_bytes were gated out by types_produced

Scope's producer index is built from types::types_produced, and choose_producer / gen_call only offer a variable when that index says it can produce the target type. #13476 adds the two conversion arms to gen_expr_from_source but does not touch types.rs, so the index never routes a string to [u8; N] or an array to [T]; the arms only fired on the ungated recursive path through a tuple field.

per 1500 programs	#13476	here
str_as_bytes	0	52
as_vector	2	56

Both conversions print as method calls (s.as_bytes()), which only resolve against the standard library, so they are excluded under comptime_friendly: the comptime targets elaborate the printed snippet on its own and otherwise fail with UnresolvedMethodCall. That is why the counts above are not higher still — it is the same reason #13476 restricts format strings to unconstrained functions.

types_produced now carries a doc comment stating the invariant it has to hold: a type it lists that gen_expr_from_source cannot actually reach costs coverage, because the chosen producer yields nothing and the expression silently falls back to a literal.

#[fold] could not be generated at all

#13476 relaxes the InlineType filter so a constrained function may be #[fold], but no constrained non-main function survives into a generated program, so the filter never applies. can_call lets a Brillig caller call only Brillig callees, and an ACIR caller only an ACIR callee with callee_id < caller_id. main is FuncId(0), so it can never call an ACIR function, nothing else can either, and remove_unreachable_functions deletes the whole constrained subgraph. Measured over 3000 programs on #13476: every surviving non-main function is Brillig, and Fold and NoPredicates each appear zero times. NoPredicates has never been generated on master either, for the same reason.

main is the natural exception — nothing ever calls it, so letting it call any ACIR function cannot close a cycle. Turning that on makes the constrained call graph reachable for the first time, which in turn exposed five generator bugs, each fixed here:

• gen_print could print a function value from constrained code. wrap_oracle_prints_in_functions deliberately refuses to wrap a function value, so the raw oracle call survived into ACIR: "Trying to call foreign function 'print' from ACIR function".
• The caller_returns_ref guard tested the wrong runtime. Its comment describes an ACIR restriction but the condition required caller_unconstrained. limit keys its rewrite off whether the body makes a call, not off the runtime, so a constrained ref-returning function got an if ctx_limit == 0 wrapper and hit "Cannot return references from an if".
• #[fold] signatures have to cross a circuit boundary. acir_gen builds a fold function's parameters with create_value_from_type, which understands only numbers and arrays.
• The recursion limit itself violated that. add_recursion_limit appends ctx_limit: &mut u32 to every function, so a fold function got a reference parameter regardless of its declared signature — "ICE: Params to the program should only contains numbers and arrays" and "Load or Store instruction found". Fold functions now take the limit by value, reusing the existing by-value path; that cannot decrease the caller's budget, which is sound because the constrained call graph is acyclic and a constrained function can never recurse. They are excluded from function-pointer candidates, since their signature no longer matches what a pointer of that shape is rewritten to.
• is_entry_point did not match the monomorphizer. It was id == FuncId(0), but acir_gen emits one ACIR per entry point and combine_artifacts asserts that count, so a #[fold] function has to be one. Now mirrors Monomorphizer::into_program, including the force_unconstrained arm in change_all_functions_into_unconstrained.

References and vectors are also excluded from constrained callees, for the reason they already are between ACIR and Brillig: flattening cannot keep a reference that crosses a constrained call inside its enable_side_effects region, and the SSA fails to validate after the pass.

Both features are on by default

avoid_constrained_calls and avoid_fold both default to false. Per 1500 programs that gives 289 non-main ACIR functions, of which 77 #[no_predicates] and 32 #[fold]. Compile failures over 800 programs went 20 → 0 as the generator bugs above were fixed.

cargo test -p noir_ast_fuzzer is green, including smoke, mono, parser and calibration under CI=1.

cargo test -p noir_ast_fuzzer_fuzz is not, and that is the point of turning these on. Five targets fail, and all five have been triaged to root cause:

• pass_vs_prev, valid_after_pass — noir-lang/noir-claude#1658. flatten_cfg resets enable_side_effects to 1 around a #[no_predicates] call without accounting for arguments computed under the enclosing predicate, so the post-flatten validator rejects the compiler's own SSA. Minimal repro is 12 lines of ordinary Noir; nargo compile aborts.
• acir_vs_brillig, min_vs_full, orig_vs_morph — two causes:
  • noir-lang/noir-claude#1657. A #[fold] function whose only call site is in a statically-false branch panics nargo compile, in release as well as debug: create_program counts entry points from the AST while ssa_gen is demand-driven from main, so combine_artifacts asserts on mismatched counts. Minimal repro is 11 lines.
  • noir-lang/noir-claude#1659. These three targets assert that two builds agree, which is not a valid premise for a program containing a #[no_predicates] function: the attribute makes an untaken branch's body execute in ACIR but not in Brillig, by design. The fix belongs in the targets — they should skip such programs — not in the generator, since #[no_predicates] is what found chore(ssa refactor): simplify acir_variable using to_expression #1658. That opt-out now lands in this PR: Config::avoid_no_predicates (default off) excludes the attribute from generation, the three equivalence targets set it, and pass_vs_prev / valid_after_pass keep generating it. A regression test (red before wiring, green after) asserts the flag holds, and the two false-positive seeds 0x835b0f1700096545 and 0x927f3216000d5b92 now pass on all three targets.

With #1659's opt-out included here, the remaining red is #1657 for the three equivalence targets and #1658 for pass_vs_prev / valid_after_pass. Reviewers who want this PR green before those compiler fixes land can flip the two defaults back to true; everything else here stands on its own.

Also

The str_as_bytes arm in #13476 is duplicated verbatim; the second copy is dead. rustc does not warn because match guards defeat the unreachable-pattern lint.

Testing

• cargo test -p noir_ast_fuzzer and CI=1 cargo test -p noir_ast_fuzzer — green; new tests cover can_call, the conversions in types_produced, and that constrained non-main functions are generated. The two can_call tests were confirmed red before the fix.
• CI=1 cargo test -p noir_ast_fuzzer_fuzz — 6 passed, 6 failed; five are the triaged findings above and the sixth is fmt_line_comments (Expected token LeftParen, got: Greater in nargo_fmt), which reproduces on feat(fuzzer): widen AST fuzzer generation and stop first-failure shielding #13476 unchanged and comes from the target added by fix(fmt): terminate line comments before appending more output to the line #13480.
• cargo fmt --all --check, cargo clippy -p noir_ast_fuzzer --all-targets, and RUSTDOCFLAGS="-Dwarnings -Drustdoc::unescaped_backticks" cargo doc --no-deps --document-private-items --workspace all clean.

Refs #13476.

---

Created by claudebox · group: slackbot · requested by Tom (@TomAFrench) · Slack thread